Payment Processing Flaw in Booking for Appointments and Events Calendar Plugin by WordPress
CVE-2026-77689
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 12 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-77689?
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable due to its failure to validate payment confirmation before marking bookings as paid. An attacker can exploit this flaw by crafting a public, unauthenticated booking request, leveraging any payment gateway named in the request. This results in unauthorized access to fully paid appointments and events, effectively allowing bookings without any actual payment being processed.
Affected Version(s)
Booking for Appointments and Events Calendar 9.0 < 9.8.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.